           converter (doto (JcaPEMKeyConverter.)
                       (.setProvider "BC"))]
       (if (instance? X509CertificateHolder keyinfo)
-        (.getPublicKey converter (.getSubjectPublicKeyInfo keyinfo))
+        (.getPublicKey converter (.getSubjectPublicKeyInfo ^X509CertificateHolder keyinfo))
         (.getPublicKey converter keyinfo)))))
 

  (Security/addProvider (org.bouncycastle.jce.provider.BouncyCastleProvider.)))

(defn- decryptor
  [builder passphrase]
  (when (nil? passphrase)
    (throw (ex-info "Passphrase is mandatory with encrypted keys." {})))
  (.build builder (.toCharArray passphrase)))

;; TODO: maybe make this functions work with strings instead of reader


                      (.setProvider "BC"))]
      (cond
        (instance? PEMEncryptedKeyPair obj)
        (->> (.decryptKeyPair ^PEMEncryptedKeyPair obj (.build (JcePEMDecryptorProviderBuilder.) (decryptor passphrase)))
             (.getKeyPair converter)
             (.getPrivate))
        (instance? PEMKeyPair obj)
        (->> (.getKeyPair converter obj)
             (.getPrivate))
        (instance? PKCS8EncryptedPrivateKeyInfo obj)
        (->> (.decryptPrivateKeyInfo ^PKCS8EncryptedPrivateKeyInfo obj (.build (JceOpenSSLPKCS8DecryptorProviderBuilder.) (decryptor passphrase)))
             (.getPrivateKey converter))
        (instance? PrivateKeyInfo obj)
        (.getPrivateKey converter obj)
